We welcome the opportunity to respond to this consultation and do so on the basis of several years 


of research and public policy engagement in relation to the topic of online political campaigning. 


This consultation response draws on the following publications: 


Tambini, Damian (2018) Social media power and election legitimacy. In: Tambini, Damian and 


Moore, Martin, (eds.) Digital dominance: the power of Google, Amazon, Facebook, and Apple. 
Oxford University Press, New York, NY, pp. 265-293. ISBN 9780190845117 


Goodman, Emma and Labo, Sharif and Tambini, Damian and Moore, Martin (2017) The new political 
campaigning. LSE Media Policy Project Series, Tambini, Damian and Goodman, Emma (eds.) Media 
Policy Brief 19. The London School of Economics and Political Science, London, UK. 


Martin Moore (2018). Democracy Hacked: Political Turmoil and Information Warfare in the Digital 
Age. One World. 


The Report of the LSE Commission on Truth, Trust and Technology. (See section on ‘Elections’). 


Q1 Do you agree with our understanding of ‘political campaigning’ and what processing should be 
covered by the code? 


By ‘political campaigning’ we mean activity, which relates to elections or referenda, in support of, or 
against, a political party, a referendum campaign or a candidate standing for election. This includes 
but is not limited to processing by registered political parties, electoral candidates, referendum 
permitted participants and third party campaigners, as defined in Political Parties and Referendums 
Act 2000. 


One of the big issues with the use of data is its collection and analysis pre the start of official 
campaign periods which are subject to regulation by the Electoral Commission (EC) under PPERA. 
The ICO should work with the EC to understand the potential that personal data can constitute ‘in 
kind’ contributions to campaigns that are not easily detected by the EC, and the suitability and 
fairness of large-scale personal data collection, analysis and modelling by a party prior to a campaign 
should be reviewed. The ICO and the EC should work together to examine the potential for longer 
campaign periods or for a regime based on an assumption of continuous campaigning. If a party has 
significant amounts of personal data prior to the official campaign, then it will benefit from a 
significant advantage during the campaign itself. It should be explicitly stated that the code is about 
the collection, analysis and use of personal data at any time. 


Q2 Should the code apply to other data controllers in the political campaigning process, beyond 
registered political parties, electoral candidates, referendum permitted participants and third 
party campaigners? Eg data controllers processing personal data on behalf of political campaigns, 
parties or candidates. 


Yes, although our preferred option would be that political campaigns not be allowed to buy data 
from third parties since this cannot, by definition, come with fully informed consent. The records of 
electoral spending published by the EC indicate that a wide range of difficult to identify 
intermediaries and providers of communication and consultancy services are now involved in online 
campaigning, which can make it difficult to identify who is involved. Not all of these intermediaries 
will be defined as data controllers and many will nonetheless need to be subject to the code. 


Q3 Who should the code also be aimed at ie data brokers, analytical companies, online platforms? 
(List as many as you think are applicable) 


It should also apply to online platforms. The platforms themselves hold so much data about 
individuals that if the code does not apply to them, then campaigners will be incentivized to rely 
even more heavily on the platforms for access to voters. 


The objectives should include transparency along the value chain and should include public policy 
objectives that go far beyond data protection and cover the protection of democratic legitimacy. A 
key risk of targeted messaging is that the ‘mandate’ or ‘manifesto’ that forms the bases of the 
political pledge to citizens becomes fragmented and inaccessible. Candidates and parties can make 
specific commitments to particular voters via closed social networks like Facebook. The ability to 
micro-target political messages increases the likelihood that parties and candidates campaign on 
wedge issues, which are highly divisive in a public forum but also have the ability to mobilize voters 
such as matters on immigration and welfare. Research from the U.S has shown that candidates are 
more likely to campaign on these wedge issues when the forum is not public. 


While Facebook has increased its monitoring and identification of political advertising to enforce its 
existing guidelines, and have publicly committed to develop an online ad repository these efforts 
apply only to Facebook and are no substitute for publicly accountable regulation. 


We propose the code will include the following broad topic areas: 


- The role of data controllers in the political campaigning ecosystem; 

- Transparency requirements in practice; 

- Accountability, security and data minimisation requirements; 

- Lawful bases including the new ‘democratic engagement’ aspect of the ‘public interest’ basis 
in the Data Protection Act 2018 

- Using special category data; 

- The use of personal data from the Electoral Register; 

- Data collection directly from individuals; 

- Using personal data collected by third parties; 

- Personal data analytics; 

- Direct marketing including the application of the Privacy and Electronic Communications 
Regulations; 

- Online advertising and the use of social media; 

- Post political campaign/election considerations. 


Q4 Do you agree with the proposed topics? 


Q4c Is there anything we have not listed that ought to be included? 


e The issue of informed consent. In line with the Council of Europe’s proposal 13 of 
recommendation CM/Rec (2012) and Recommendation CM PC/Rec (2016) on Internet 
freedom, social network services should not process personal data beyond the specified 
purposes for which they have collected it. Electoral campaigning constitutes in most cases a 
distinct purpose for which distinct consent is required. 

e The location/type of company that can be used by campaigns for data storage and analysis. 
Due to the use of Aggregate IQ, we still don’t know what Vote Leave did with the data and 
probably never will. Therefore, for the purposes of campaigns, all companies involved in a 
UK political campaign must be registered in the UK, and campaign data of UK citizens must 
remain in the UK 

e There could be a special category about using personal data to make inferences, for example 
using Facebook likes to predict political preferences. 


Q4b What topic areas in particular ought to be covered in the most detail? 


e Personal data analytics. Privacy helps protect freedom of speech and facilitates political 
debate by providing citizens a space to form opinions and develop identities free from 
surveillance. An online sphere where every conversation, comment or post is recorded, 
scanned and analysed for its commercial and political use could have negative repercussions 
for the free expression and exchange of views especially as privacy concerns among citizens 
grow 

e Online advertising and the use of social media. Digital advertising currently relies on the 
constant collection of significant amounts of personal data, which is then organised and 
packaged by digital platforms such that access to individuals can be sold to advertisers — 
including political campaigners. It will need to be made clear what aspects of digital 
advertising and social media targeting can be used legitimately by political campaigns, and 
what aspects cannot. 

e Transparency requirements in practice. Transparency is a pre-requisite to greater scrutiny 
and accountability of digital political campaigns, but only if transparency is of sufficient 
relevant detail, is provided in such a way that is assessable, and is provided in a timely 
manner. Again, co-ordination with the Electoral Commission on this will be key. 


Q5 What do you think should be covered in the new code of practice that isn't covered in current 
political campaigning guidance? 


ico.org.uk/media/for-organisations/documents/1589/promotion of a 


It would be very helpful if things like data analytics models and proprietary software were taken into 
account, although this is less a question for the ICO than for the Electoral Commission. For the 
purposes of regulation and enforcement these should be costed at market rates. Currently it is too 
straightforward to cost them at much lower rates for the purposes of circumventing spending 
regulations. 


Q6 What factors ought to be taken into account regarding the particular circumstances of different 
types of election or referenda? 


Q7 Please state any case studies or scenarios you would like to see included in the code? 


Vote Leave, Leave.eu 


Q8 Please state any examples of guidance, tools or good practice you have encountered that could 
aid compliance in this area, and could be included in the code. 


Council of Europe study, DGI(2017)11 Prepared by the committee of experts on media pluralism and 
transparency of media ownership (MSI-MED https://rm.coe.int/use-of-internet-in-electoral- 
campaigns-/16807c0e24) 


